VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Nov 1, 2021· Updated Jun 17, 2026

CVE-2021-20136

CVE-2021-20136

Description

ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An unauthenticated remote attacker can send a specially crafted message to Log360 to change its backend database to an attacker-controlled database and to force Log360 to restart. An attacker can leverage this vulnerability to achieve remote code execution by replacing files executed by Log360 on startup.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Zohocorp/Manageengine Log3604 versions
    cpe:2.3:a:zohocorp:manageengine_log360:*:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:zohocorp:manageengine_log360:*:*:*:*:*:*:*:*range: <=5.2
    • cpe:2.3:a:zohocorp:manageengine_log360:5.3:build5232:*:*:*:*:*:*
    • cpe:2.3:a:zohocorp:manageengine_log360:5.3:build5233:*:*:*:*:*:*
    • cpe:2.3:a:zohocorp:manageengine_log360:5.3:build5234:*:*:*:*:*:*
  • ManageEngine/Log360description
  • Manageengine/Log360llm-fuzzy
    Range: <5235

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.